Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
- Size 1.5MB
- Sample260419-2fvxqabs5p
- SHA256 6210db8269269ac89c59dd59a630ede607fe05def4acf6b38556e35dbd9409cd
- MD5 57902354e1d062bc9f489228e5df73a7
- SHA1 5b11a8737c893f7d67f76d07a31c8697b8d85789
- SHA512 eb87c4a93bdcda95403b04cddbb8ee3bd27bd3828cb5e3e2a54921b7c0b0a0e7eb66b4653b54474e7219d16f4151784bb642fbbbe8dcee0429deff5f31bbe5ca
- SSDEEP 49152:jgVyy9ixA7Lk8NrJ+8FfvWUhnU50rpAQgAT76sQuE:j8tWUy502qGsQr
- TLSH T1BF75CF17B29610E9D07AC1B98B669121EA71B8450B30BADF17E067252F36FD0AF3DF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3816 alg.exe 1244 DiagnosticsHub.StandardCollector.Service.exe 3292 fxssvc.exe 848 elevation_service.exe 2240 elevation_service.exe 3844 maintenanceservice.exe 2820 msdtc.exe 2156 OSE.EXE 4736 PerceptionSimulationService.exe 3000 perfhost.exe 1128 locator.exe 4216 SensorDataService.exe 2076 snmptrap.exe 3376 spectrum.exe 2072 ssh-agent.exe 1268 TieringEngineService.exe 1532 AgentService.exe 912 vds.exe 2840 vssvc.exe 2440 wbengine.exe 2516 WmiApSrv.exe 4352 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d17f56497932a944.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000431733cb4cd0dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b49f3ccb4cd0dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c7773cb4cd0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b6c4ccc4cd0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ac843cb4cd0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe Token: SeAuditPrivilege 3292 fxssvc.exe Token: SeRestorePrivilege 1268 TieringEngineService.exe Token: SeManageVolumePrivilege 1268 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1532 AgentService.exe Token: SeBackupPrivilege 2840 vssvc.exe Token: SeRestorePrivilege 2840 vssvc.exe Token: SeAuditPrivilege 2840 vssvc.exe Token: SeBackupPrivilege 2440 wbengine.exe Token: SeRestorePrivilege 2440 wbengine.exe Token: SeSecurityPrivilege 2440 wbengine.exe Token: 33 4352 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4352 SearchIndexer.exe Token: SeDebugPrivilege 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 2084 2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 3816 alg.exe Token: SeDebugPrivilege 3816 alg.exe Token: SeDebugPrivilege 3816 alg.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4352 wrote to memory of 2160 4352 SearchIndexer.exe 104 PID 4352 wrote to memory of 3556 4352 SearchIndexer.exe 105 PID 4352 wrote to memory of 4500 4352 SearchIndexer.exe 106 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_57902354e1d062bc9f489228e5df73a7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:1244
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:768
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:848
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2240
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3844
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2820
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2156
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4736
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3000
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1128
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4216
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2076
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3376
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4716
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:912
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2516
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2160
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2844 2832 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:3556
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2836 2872 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵PID:4500
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 3383e731aef2f5235b580824b9f381aef7745386499dfe15645c57d7131050f8
- MD5 d9bf42918617114f7a4f265e0f99c406
- SHA1 12ee2d5499dca80619583ceb5595e3e75bd9949e
- SHA512 f2fd324b18dcb1e8d72e7d87ad057c01f5da21c9fc049d08b62874013f67d77dca75128d70828bfaa42df9c610d1d2231d1971a315809ae60e4075cddfe9efa8
- SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnlAQgAT76sQuE:G3q6sjBRqGsQr
- TLSH T11DD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 0c125098ee09f0b6348ea8305ff36b66609c38d29f152512aef44c5a9fdd0144
- MD5 f10013c34b6971b6b1c29d4660e68b49
- SHA1 33d39224dc0cf496c4f7859804ee73f995247242
- SHA512 22221bd1482d70f8929429f1547e24cce37fafb98a595bc3534eed354b0678459040536b1755601a84c21259ee42ad4ec7d4673fe665f95389290f21b89bde7b
- SSDEEP 24576:qXYfDtczAAAfYLH8AcevDN0FImbwQuq3Wia7gD:xtcrAQgAT76sQuE
- TLSH T1E875F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 7eebea082694d62c4ceb2d3564806202be3e523ef447d453007a51576bfb3413
- MD5 e5a73a9900fa6babc90998b0586ca0de
- SHA1 2158047d38d2e3aa5ed525658dec88584e078145
- SHA512 b3f6f7a511a0b661dbcb878e126c372ef2d5b6f0526cae6e4c91ceb2fdb1bb22f80a5b94aea74bbcfee08e4d128291437d90df89478ae8f9371acd881a036bf2
- SSDEEP 24576:D0Le5ji0hmxxrMdAfYLH8AcevDN0FImbwQuq3Wia7gD:DPji0AjSAQgAT76sQuE
- TLSH T17F85AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 eb68920f0a4261dbc8ae7c9387a82bdbf809e8261961f87df881358d0f5446ae
- MD5 d5cd5aba106cc4d2d2c89dd43bc1206b
- SHA1 9e2ff544f7348e26d00bdc716e1ea8a6cc37ae50
- SHA512 2e91a0bd4a0443fe59a3f8c6094eb512d491ebce298685212dfc1011fa3aa892d8a5f3f5c7f8030bcf7e76cce5f92456f0db219c214705954d2b8fa2a5e4cea7
- SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWn6q8wyubAfYLH8AcevDN0FImbwQuq3Wia7gD:8/ezSC6vUzPveHjyWAQgAT76sQuE
- TLSH T12D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 c0e4120ac6769e2b9ecacdf81c379b5fe4afe6e30fe43415198bb58b04904534
- MD5 553adc2396cdd969b0af2575a277e7b3
- SHA1 c889554fbffdee4462af0863cfbea8b6f7aae956
- SHA512 a71774ed3eb7f2b21ccbf27ccfb2daacdc89f54bd4c271cdaddef69fc8bf5c41bad30be0e88d2c5ab9fcbaeaf56b973b771487aff79be9964d84639a68707e99
- SSDEEP 24576:TVbqPb88hv/l+YcAfYLH8AcevDN0FImbwQuq3Wia7gD:TVO88hXl+DAQgAT76sQuE
- TLSH T117559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 f05f099cb008bd32bb9dbc6f6a374ec2539730c39b5d1fd1524041422a10eca9
- MD5 de38a8835c34be08b5d08aa7780a7879
- SHA1 b059d4f96f988169588ae05185d1149dc383180f
- SHA512 c3fc7a57bd184bdba54cad2474eca537ae4414f9e2d325a19f9366b3633a0f334c5c31b16bbf082f918a5693b84c54d1ae5d40270595ae42ad2b8ddfb2f97539
- SSDEEP 12288:CLJAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:CLJAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T188552357864C30EAFEFBD1369CBBA5B963D1BCB8824597AA00463BCA793D408D1D4D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 2eecc2f42e2905e182b728e82f7185bfba54f2a1eefd872b570766683ecbc08f
- MD5 c8d4b701c527a6ecd49f6d9a666617cf
- SHA1 7a1aaf143afc9c207ffbd13cdaabc16016ec59ab
- SHA512 eda59929882e2b25a9dfd64d8d6e895ad927de35701ca469d63956695debaaba4e95e141ac412592e65c38e754b536b8212a2da29eadabe7486f52f01b778d3b
- SSDEEP 24576:TJIUUAfYLH8AcevDN0FImbwQuq3Wia7gD:TJIUUAQgAT76sQuE
- TLSH T15675CF3BEE28FCD2C67E8D795A918600E7B278704B51A3CBD165830EDE235E05E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 facfdae07e92c33689b1761e98f586573ca2a2944055328161676001f65b69c0
- MD5 4484c73aa38a71cca5106a8d7bf758de
- SHA1 b38795608aff44356007500249191c337da705d1
- SHA512 2a59a25a7bd6b8d8eb565305df60a2c7c24113a05cf196814f0fa5d5e0e7692f6a2ad72f5db955eb1fe1489ab86c38d5d56bbb4c4af812bb8b98a9ca5439ae2f
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THj:ZQvGAdlCEL8c/DRNw5CQqGsQr
- TLSH T16C266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 3ec6ec690c8921e21fcc936eb603fb48eb3a3d7687861f008704c7fd298769a7
- MD5 0bbe597d3449de232e4a9a331f3655f6
- SHA1 daa1c3d786bd9f303d128c9f50b41bb5d9aba694
- SHA512 f6e81ed6da68f67b38962cb8d273ecfabe01fc1ba2f9c302323f9a6609a4152737c25774000c361525d18ad1800823074138b51b2e92d785de7fde1da2b5124c
- SSDEEP 24576:X0ewsAjCAfYLH8AcevDN0FImbwQuq3Wia7gD:EljCAQgAT76sQuE
- TLSH T1B075E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 e88a2f5a18d6285a91524ec3ceeba0a1e7133e9c620ae59a7bc72083bfaf76f6
- MD5 c64a5fbc7803736fd92b1e3baeb14e9a
- SHA1 fe23020e444c9780a190cd1ae5cc402857a4320b
- SHA512 2b07a8bdbedf25215a6ea6495d8db6eb30c9946444f2216a0cdef970d9378895a6c76e1f697a6a16cb17f529f37a223e88e6d95bed76e2b278b378369481c6b9
- SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHZj:dUEtQevvqc2W1cpV2tI32
- TLSH T130474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 2ba9e66807c6803588fe122be9a2e573fd7e64081ebdd5ff4a8c352d5fd77c32
- MD5 817c55b819e57454330e34d4cf3b5aea
- SHA1 de8c45d31eb3ab299737dc71c4d04fdc72919f4b
- SHA512 ff4e64cb36d4ceb37c289ae7acb4aade91d588e8c6dda20147018ff1c5c342bf0c217109febbed38885978e5abb0910b50b426ee50157ecbe2d0afdb3bfbddb8
- SSDEEP 49152:sCbRquA/m2yL5zTfFiV+XenmE3/ziAQgAT76sQuE:FoquVjnmUqGsQr
- TLSH T138D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 59f995a79a7d1bdad2baf7fedf70cbe01911c44ca5967284ae530d10a95a1d28
- MD5 290b4d5d3c0e6b1a1a640825fcdd8142
- SHA1 b5cc3530c4e8db628ef639e8e81a63bba2f93527
- SHA512 5dfd84262366e6ecae562b68a58c050824b5c47c96808a3128d3f17d1b15cd1f3e680ea88ed0a1845f7a689e0821afcd5871cd9bde2d39b1b396adcf6ca11f83
- SSDEEP 24576:oAhGL3IFoiwtA5l7S53PAfYLH8AcevDN0FImbwQuq3Wia7gD:oAMUFoiq5fAQgAT76sQuE
- TLSH T1A9359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 0c26fb88e3c9fa2c99d459476d01418770b5f841cad516941ed692ecbb44a055
- MD5 9feb3f680566841d9d4ba19aac7b6615
- SHA1 f4f80334726a1033914ff6d3d1c22fd6dd3dad52
- SHA512 606ae52e2ed841968545193085f26b17811d76d41b2f028c2db53894a4291a907c7da75dafb0409fc937dbae3e076a380197af13da704a9a0ef44dee414f398c
- SSDEEP 24576:nwu4OW2AfYLH8AcevDN0FImbwQuq3Wia7gD:nwvOTAQgAT76sQuE
- TLSH T14965F14A76A81CF9E9A781398597C136F7F2BC152621D71F0360C75B6F37221AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 657005692464ec6ab22c12333505facb53ba2a3bb1fe8f691a910bf519129cee
- MD5 53264b893aa72a482dca47816f36c6db
- SHA1 93c166c2344fef68add73b135503716e580c69e7
- SHA512 8f9c0c2971a071fde8d9ee5642a1da44be52d12c2bce204aea919995188c27bcdad05b6a024b9161247519468e7bb7aaf97c10e9143f9dd83403c8b7509fd41d
- SSDEEP 24576:IZuVAfYLH8AcevDN0FImbwQuq3Wia7gD:zAQgAT76sQuE
- TLSH T12A55125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 ce0ff489aa6780f0a9c5aebc72651f0c3057347e1b24c4644192d1d0000041cd
- MD5 c8b6b8cc49bb483067b5c821c2df2fee
- SHA1 b401f125ba301a5f172e590fc9f0982ef20410a9
- SHA512 9e19423383fef64c88032e3f379455013437b913d9c14bf97b7a677a889e7983b4cb58e92320df458a504ff2204e14e0d0686a1bb71a3dbd842b32971368010c
- SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:9QRQyi36YOcPbLvw2gAf+PN3NqGsQr
- TLSH T1B8667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 565c475a7383bae7e77aba23937b82eceb97af2bbde7b365542abe26b4f95bcb
- MD5 653cfd64288e783af3b0e73ce74e9363
- SHA1 e90cecde2a2a2a71b7e66d83e027acb1862e9049
- SHA512 b7552e9363d995a6d0fef3bab21b9d656846246638093e49d3cea1e7bffeb83733e4d3fc9090f82b700c723af1040e43285c2ccfeb1907b02ae7825bcf2fb36a
- SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:2QRQyi36YOcPbLvw2gAf+PN3NqGsQr
- TLSH T1E3667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 49d5378f062990422f5ab23574331ec09ac0d5d59d6ea3f6f4998092827f35a9
- MD5 7fc6be2ee846c84223a67347cefce7a0
- SHA1 7cf227c34852252047ff1cab78d9e87a57379519
- SHA512 e24f5b6f4e0fd5615fb9191954ed7fcf086c13180c1f6dbf4ec215e20d04ec81ce56447bb0dfef882cc7cac2386d685fa9c07c56346bd206f3bbb309f9d5c081
- SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lAfYLH8AcevDN0Z:B68Qg55nhceWu7PNU3/SAQgAT76sQuE
- TLSH T1A1B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 1bf098e429a45246e6aed6cad95c27b17ecb4c277c8ae7c59102998abf0a99c8
- MD5 33fca13c81aad89d5862bb9b87984b11
- SHA1 7298468fbb53d99885ba5dc34335a8cfd60da974
- SHA512 37011a06ab9da5dd7fe8598c2040a62d9cf8bbf42c6906d984e53f06d89e48f19f1fedee67b5c9052da2df28c15197206b6428a01defdd4a59e1f90c609ec4b4
- SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99t:ty5112gYy5azzVvt69nLKnhZSqGsQr
- TLSH T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 9faac4079caf17784ed7de6094c73b88d7c3cced59cad5c17e36a2803c951ff1
- MD5 8796b6ab7d0f6b8b6041dde412a2149d
- SHA1 30335ecdca2f5087c98dce65ad1e395e95939159
- SHA512 d0ce67e198a8600e7f96339044dad4c2f2fb1c118608af46df4f3cba7d206e2bdd0768d33ac35b325d34761762c7cce4ca2302ffa19c80621ecd9625014b74db
- SSDEEP 49152:mB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQAQgAT76sQuE:Uu6Jmdxd2dFqGsQr
- TLSH T1E1D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 5ab0330e857d3d27e1b59374a89b6b1b2333925287eaa8271c7fad636bd4d81d
- MD5 35632727efeb10756803caded16f6b5b
- SHA1 52f393c2c25ad93b2fedd41d06987673cad871c1
- SHA512 efa916c04827e00ca4e5fd6a34375d25c10c9a15fb720cb77944aa96d5d38344bab9ebbedd51c0d008f89f29761f5b0ecc69907c99c304b3b71056a6ae76d4f6
- SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4x0AQgAT76sQuE:+mifPWRUqGsQr
- TLSH T192B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 552df4ff27eb172f61ecfc1bbec72f5b9a6db8bd40e20f40b676e935b1e38103
- MD5 4eede310203e5d681812a1af2e17f09d
- SHA1 ff4baa40e17ad32775d1ac5a918ee05f18f78dda
- SHA512 ff1194a4a501b4356c324c427c4312f1edc550f8db40e5384949a938fd1266cba338f35e7a0ebd8d8ca2b8d58941a0ce3335a90410b492aa6093c2df07a01f22
- SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqVAQgAT76sQuE:w5dKii61+qGsQr
- TLSH T1FDC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 0fa193bcb9b133b756475b8ab8442222a23cd46d82e4749c7acc6fad0b06dfd6
- MD5 5a99819d11c11ac89e0aaad2b7151016
- SHA1 2c8da06f0757196d907b2d3f231e111d6b1dc9d5
- SHA512 c1da5a601b044c859bdffaabf0b97f0a9a105481ce7478d12870237009b3594a0d32c80ee99a0d4926e115b95e4241a5e97441c80c85795a7edb587bdeba2140
- SSDEEP 49152:ahtSn8EApI0fig3giDn0AP5wAAQgAT76sQuE:bX2imphYqGsQr
- TLSH T1F295BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 620db43a436cc9fe0845c0d35061538010ec2f83b1302871896a407cb120eee3
- MD5 2f705655e65bb6b7612e0b87f3a3c07b
- SHA1 7038b3143b2426825c2d9218f53da4530a1b1811
- SHA512 e440d903dea2a6c9ed34c4d71963239474763a99a4d9163b1aabf7ffc1fcb8ee52040f565eafe0596c730b1e540537530555ec8fd9d05b05368a49e21d0a991c
- SSDEEP 12288:XhAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:XhAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1EC55235B594C30EFFCAAD1368CB7A1B8A3C47CBDD346539A110A2A8A7A3E418D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 0026adac6fa175d440d842af9462e1c06ef4e171f1783f63a6e733a297e1b309
- MD5 4393666c3268e5a3508dfc9be242fbbd
- SHA1 be4a6c568f6f24d13e227ec02fdcecfad6325b87
- SHA512 0a4db53c792da28cd77335d8669930281d2c8c098fdd5aecdf16c27acffc837dec6f924276ece3c21adfcb53a32af7f4308db0dc5c23f3fd0aff49a8c35baa90
- SSDEEP 12288:teAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:teAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1C655235B594C20EFFCBAD1368DB791B8A3C07CBED346939A110E2A867A3E418D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 9293827c0e6bf11c757588aafa1a145c8722e855ea10a0930e7cdbfb3025ae5d
- MD5 7b237aac5d55af23c0830e82b157d697
- SHA1 a51bb6c39370e8932ff8827d865b4997865758fd
- SHA512 ad9916cb702991ed81546f1fdf5d6e945908b0717c8e82a1943519a7e0fb144fabfd89cb130b1df05ca835d612de0ad95cf7f3dbb494b8128b8862e1be352359
- SSDEEP 12288:zsAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:zsAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1D655235B594C30EFFCAAC1368D7791B8A3D07CBED346939A150E2A8A7A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 5c55c72402a8dc612efaf9077d1b0bb7b7343f7a7238b6ca1765c6aca86fd74a
- MD5 60c46df5405c1b96bfbe8d06218b9f35
- SHA1 9266df29890e59baf9df04ef79dc1e91f5eb4fdf
- SHA512 9d85b2d602ab0af4db575a6473c8025b91e0d2de30fa742c2d15e10524b9c070bb23b49372e87048f6f6b6684c169840d6ad5bb73599689ab81a022185c6cfd5
- SSDEEP 12288:1VvAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T140552357165C20DAFCBBD135CCB791B9E3E1BCB9930293DF06011A8A2E3A24895F4E74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 778531c5365dc0ea70848fdfa0e6bd9c6d0f418780e3b438dfa51c79ec092e13
- MD5 4abffc2c7d059a8fc7d6d52d6781b5df
- SHA1 670b056e79791162bc181fc7a2cf2ed7cb4ba11b
- SHA512 fb344a16b62af0d8e2b29b7acc2856fe31da9c65e468aec1edf96633684fb91b1432fbdd4dc674fd8d48ed54ae9de2f65304b21b163a6c3f9948a6ff9ad97b44
- SSDEEP 12288:qXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:qXAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T16455235B594C30EFFCAAC1368C7791F8A3D07CBE9346939A110E2A897A3E418D1D8D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 3062fff37b097783a500d91858ebb3c080d61ead32fda43e5980118918846b56
- MD5 ca24e35895302012dfd3af160a59c2d8
- SHA1 20b0cbf7a24c65fe3296eeab9a3689646a145209
- SHA512 74db09eccbb616d43422f2863d9ef7574a472a28909375256c5a91c48a001fcf376f707641217fcade940a4ad5738a71b6da6626e3fbb66be75521af658e493b
- SSDEEP 12288:R6AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:R6AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T17A55235B554C20EFFCBBD1368DB791B8A3C07CBE9345939A110E2A8A7A3E418D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 9e9db0c4947ef5be7e92dfe65ef5005eb62e8446a0642bd5a0516ad9d1288001
- MD5 cd6d18b7712bb3d2796b0a73dddaf686
- SHA1 404b9466dd6a8aa9928fc8ef5df0667c6eee7e88
- SHA512 5ddada617c64da2eece771569f700db6b7e5ede44184607b1232768082c29df949011ff50297ffe48feea1abe62ff8cf2441baa5b099db824baf62ae8310a78e
- SSDEEP 12288:3GAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3GAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T12C55235B494C24EFFCBAC1368D77A1B8A3C07CBED345939A150E2A8A7A3E418D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 e2887c0d0fa21000ee059df8df7c3cbca2dad74d6998451428574aeeed86723b
- MD5 562699c5403223694461e2e50154f2eb
- SHA1 494c87c0cdd30635631126c6df696396b61d054e
- SHA512 8a88e3af95edbf5f6b33799902bb9c13228f05a7f0dd0ee2082e1a6c2d3ab71d3468bd5fa519876611bfe0ec169bd2b732052b611d219b12e7d87955227e88ec
- SSDEEP 24576:aZMRzFVSO+AfYLH8AcevDN0FImbwQuq3Wia7gD:aZMRzfqAQgAT76sQuE
- TLSH T19C750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 34323280d9b3b4b43fb18418e66e009d32806e01aa196b9efa800819e6ae824d
- MD5 a3de62ec9efb8a45faa238080b9ce5fa
- SHA1 6cb4f9c4c39bb5f6142e29ff5d55c6948aaab00d
- SHA512 50acb35037627e355ef66c4c4941690321ede68debe5a23f871b92b0f232cf273b91643ae636dc93cf4b677ee1b1b794e8ffcdea294a678f0334993fa26f44f3
- SSDEEP 12288:WFAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WFAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1B855235B554C30EFFCBAC1368D7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 f29ca11fcf605f307ef0759b43df5390aa3e17abbda444c3f2be0119401e02e6
- MD5 b1d397859cfba528633c9880312cfcec
- SHA1 d570884404a98b58f9a1ac1ad7e748b143f8079c
- SHA512 8ffad941119d7f84f56c0e938dfd2593ec2372110ce781c9ae5a4f56ddad70bf1eac407d526008598a5f42ccfeafef03cc7ceb6b4f93d9847fe0bc4316c28b22
- SSDEEP 12288:Q5AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:Q5AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T11B55235B554C20EFFCBAC1368D7791B8A3C07CBE9346939A150E2B8A7A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 0d8679262799c224367252c5a79fbc3b9724dbb38a4fbbee3cfd9464d1f76ec1
- MD5 45be9d7a7a466f15095338e0757575ab
- SHA1 afa851386b19c1982210357a8197d931e77000bb
- SHA512 1d4246f51de5b0b1e539235cac4034f852987eba57735ff0c13873f2eee3742a240f3b17485fb240bfde9e66aaaa5a43d30a16305f14920c72a52a993fdd6c91
- SSDEEP 24576:azyyAfYLH8AcevDN0FImbwQuq3Wia7gD:azAQgAT76sQuE
- TLSH T14F65020763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 09a998a8b11a502285fbb504b2bbefd5b7a549e7bc57491c6fd6807970fc3002
- MD5 cdafef6cc1710ed8bad136bf82894bea
- SHA1 57eee0d67e1314aeba7afdbffc865e59943ed568
- SHA512 08796001dcf8db2c5b5f75e98eb9f504f799278f0892bf3448f300f1befef81aca3d140dc00e6bc600d069e1bdd2983567ed9f65ea5cb8af15d6f7e8c362eef7
- SSDEEP 12288:mFAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:mFAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T19655235B554C30EFFCBAC1368CB791B8A3C47CBE9346939A150E2A897A3E408D1D8C74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 994f69a27709b116d268e5091bcf90acf6ced1ae21a2ca6b437c1f75706c1c29
- MD5 bb0d66fb01509083e19001295c9b896f
- SHA1 dcbdf574c590469759b5f2a82ac08d0e0ff9ab58
- SHA512 b9f71fa402eb1d17b000ef113cc817630cd0f0cce7754c8aaf2e26a5f40a421caf1ebc56934d57287f6c085dd379c5f1ac75d926702b7ad95b0ca7f6e4278622
- SSDEEP 12288:mFAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:mFAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1EA55235B554C30EFFCBAC1368D7791B8A3C47CBE9346939A150E2A897A3E408D1D8D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 b26c2c020424b6cb9f6ea75d651c375f26ee450920c73b9595eaf7c11ba72d17
- MD5 a6ca63c01aca6878dffad094d9142fb6
- SHA1 810ee9e0724d9c8f83729246e97d59415225ec28
- SHA512 fa6a917b855f3a806cd8aafce3eb1facb44b9bce0f55319464ba98c2e19ed741d5faacb3f6a1999c1d7ea616db778d368b631fe01cc8d07ba76fa144a481100a
- SSDEEP 24576:vCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAIAfYLH8AcevDN0FImbwQuq3D:vCUZPTY+8Wg2lIL8lrIUJLWwXAQgAT7o
- TLSH T10265BE1EA3DC089AD4BBC1358A518A16EB72782E1B22D6CF1160C37D2F27ED95E35F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 c2f21f02d5f4195925d7fa57109bdcaf50c0d1859020191f037c3522c6e978bd
- MD5 32a6ef79b5a352a8638a85b8c80a43d0
- SHA1 a0a4bd53740b169c905053dd3e60140050a4b63c
- SHA512 6c5d449fbd0e04db39cee75adee2a210abcefc3bd94db6f59fc0d7d151242bae441256eb16a88a00365ec28208af232ffcce382d4ab21541aba71c3159dd77f2
- SSDEEP 12288:obsfVAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:PVAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1E465010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 3cc26b4093895de1108b28c6396899931896a15a10df6495cf5d2c20c8ab6e6f
- MD5 dd32ad3f25cf2e0df3e13024322722fe
- SHA1 218b2af26ba4b78981ee886e3e4fc1073a0eee71
- SHA512 b60788ce1556145819e4d8ff6a4f83a9d693950fbeaaa38c644314fa504d71a10a6838f7a91a7b7c727534e5b9b912b8747b105af12ff30f7993a372e5bacc24
- SSDEEP 12288:PMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:PMAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T147552357864C74DAFCBBD231487BA1386399BCBC870592DB640A27C9793D8C8D9F4E24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 d00da0d4cfee4dfca9923a56637cc23834a6f5784852476db48fc89934c8f059
- MD5 e210b5c9b6fa9d09178e6bc676540497
- SHA1 3972319298c2611701cad3328fcb96f2cdb28057
- SHA512 464bb5ccddc38114dbc6045876695d845ff289d2d728654b7805922f69a35d642c7b87291c3872e60604c7825be19a123a863dc791834560dc66a3a3ca467858
- SSDEEP 24576:O8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCiAfYLH8AcevDN0FImbwQuq3Wia7gD:XRZwQCyiHiQEaiPnM9AQgAT76sQuE
- TLSH T10385BF1E62DC46A5E0BAD278CDA74407E6B27816473197CF0191C27D2F37EE49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 b3001263b0209b61420ae29ccebbee1bbb2b256d99e9aa124fcaa00765f95dbe
- MD5 b184de4e2099308b25b4ca4f4053c476
- SHA1 2d3513f31ecf01cdc9ade11ed0db3f5a4b097f11
- SHA512 b35acc15d21728ec06213c62a037fbdcae454d1c5e0bc0cae4eb31dc7c11faf9f6e7ca0135da65691cb2e5d9467b9007e698350276d97958440cfd62d6a607e0
- SSDEEP 24576:WbxA1UG8AfYLH8AcevDN0FImbwQuq3Wia7gD:WbxA1UhAQgAT76sQuE
- TLSH T12855122F569C24E5F5BAE13988A28119D371BC2A531193EF108183BE1F3BEE89C75F51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 4fcd30585d4cb0afa5407d58f6352885f228ac98eed90ae6a96d3b2545143c04
- MD5 696bf49290be3f06ce9aff6b729564fc
- SHA1 76976ede0cc132180a2f7d14106412fcb1b30aa9
- SHA512 961bf7b25537faab30cc30fa3122740ae1ae3006f4aa7a3262bdcbb9992443cb11da75cd90c40acc88cb41e5702fbf35d23cbec318696b94f820690ee88aa2f2
- SSDEEP 24576:cjsmP0yHaqrVqHra44KDzMsrnfAfYLH8AcevDN0FImbwQuq3Wia7gD:cjRP0yHfVqzlAsrnfAQgAT76sQuE
- TLSH T1B945BF2EF2B910F9D8AAD136454107B5BB71B82D1F209AC70170C634AF1AEE89F35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 3fbc9fc78151c117a80b9a169c35ed1f5037c007d9ff3bb15d2ab12d8fa08997
- MD5 ec8ace9ccccda9ccaa4fd0025ef9710b
- SHA1 f7ba0dde4bcef67e5c777e3ac0485a0f36b5a45d
- SHA512 12a6ad3d4b2211df37115772d536e010cffe0df9a6b80397adbef4fe67ca140e87b6049f87afee41d0cc686dfbb74ebda2662ceb28409d2a8ed41bf7769a991c
- SSDEEP 12288:OaAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:OaAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T19255235B564C34EAFCBAD1368C7791B863C0BDB8834653DB140A3A8A7A3E499D1F4D70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 cd24e5a1c0240b44dca5f9a101a4ca063f84b9e3973cb75cdf865e9e3478227d
- MD5 7ae2a767422944fac05170b340998348
- SHA1 bde68d3276302f23b66d1e58c7a8f079886ba992
- SHA512 bcb258895bcb02790559a3376a6176d2ba5f00f916fde28ed71e64229f18266eea341a82a7019685edeff31e01c99ae7f7faddaa01a34271712f536b2562cda6
- SSDEEP 24576:obLBUTAAfYLH8AcevDN0FImbwQuq3Wia7gD:obLBUUAQgAT76sQuE
- TLSH T16675F155E79400F9E87BD13CC9B68526E2B2B8AD0354E7DF03684B551F236E58E3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 d5f620c506bd04738773809b7cae5a28e3562d21a0cd0604996f247b6fb3ea43
- MD5 2d418534155ad5392a62b11959850245
- SHA1 19e12a8e9267c73f1f8dcfaac8635d6051c9ef77
- SHA512 f4ee940fcb790572eeaaa8f6ce316be89955b88044b22720287fa90e0bf2d6846568416c7dd11c535fca929f3f894bc482d6ca0671b4a68a84b555c03ff5cb32
- SSDEEP 24576:PpYNHjAfYLH8AcevDN0FImbwQuq3Wia7gD:PpYtjAQgAT76sQuE
- TLSH T1B065F12F52AC18E5E57BD13D8AD38219F2727866131193CF05A0837A1F27EE8BD39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e70a860032c9413cc4903b8dcbf9827540514a9b59b3f062bf850cde4d330a2b
- MD5 1d67f25d03d85e50760c4abe1c6ef435
- SHA1 d1df4dd260fac4ca00c7747df00b49ffbf0dfd5d
- SHA512 be0c4c4455577c89f1e7467d4edc9e97fd21c426f3c2b5b946c2b5d6d19f36a12909a1f6568c15a7b33fa5601f30eb430ecdda29215f8c4163e7ad700d037a4d
- SSDEEP 24576:xnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKR:xnXoJJYH84VVS6AmEOJas+cHBjSSKHPh
- TLSH T1EA65BF6EA2BC04E8D5BBD13DC5C34506F5B178661321C6CF026182BA7F27AF59E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 3fd7a7acf707469137e64f20678c9261a8ba89c35fc2ae5f77ac5a27ac769593
- MD5 3f1e9d5e0c707c9f6f6c2119af6a7a0b
- SHA1 66ccc7ba467ed99366e543a8e43595cc0d5482b5
- SHA512 5c77a9dd8eb8738921b368707793f88becc98f6defdcfffc2f9d1cc9815acc508d1e42d9264f0e73cbce595d62616c988f4894724e61b3972e8b0b46bfd88bf3
- SSDEEP 24576:+v7Xbxd9Tuycf8M/TYlSuxrr2PCpAfYLH8AcevDN0FImbwQuq3Wia7gD:+DLL9TuJ0M/TYj2P6AQgAT76sQuE
- TLSH T148858D5EA3EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF0593DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 90546ec95a3f10b1b7757536da93c20acb695f8a89101a9f665e3750241df586
- MD5 8931eb800a622e6f40e8b52dfc5e9bb8
- SHA1 d5648839827542465e08742576c22c16a12cdde9
- SHA512 539150827ec649f457d719c99b2c703040cf92031d4e0a92d76ebad61345343219c2c4626c9e9bc131a2813d263074412d72b1bf9c7d9c39c8e71ed1409fc9dc
- SSDEEP 24576:xegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wAAfYLH8AcevDN0FImbwQuq3Wia7gD:xngOJOmPOHzAAQgAT76sQuE
- TLSH T12A55BF3FA7BC15D5E07EC13D8A968916F6B1782603255ACF0160827E5F2BEE46E39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 08c458dbb3cf18d023c641cbc385d050a14688046b5f6bfc5a17c7a2fba94a2a
- MD5 d4e10d262a6d49bafc9c4107dfc2e3cc
- SHA1 bfa53963b63a043799bc56f09677babb9eca61a3
- SHA512 be8214b10cd8396517460d3ec1813b3ddb7fa58e5cd0edc3e05f56e6658a39791687124b2afcb7baf5baa1d0d100cafba0a4d82237d17ca64d0de1bd4aacb8cb
- SSDEEP 24576:HLJnJiTk3R3waE4JrO6AfYLH8AcevDN0FImbwQuq3Wia7gD:HLJnJK8R304lvAQgAT76sQuE
- TLSH T13D75D02DD2A810E8E4B7C2B4815A1766FF71347C2B2169CB19B4D5353F22FD0AA79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 4c20b8aacdcf713dacc836d48c73725a17d0b475648998a1c3351b1151b1549b
- MD5 1674cc616185a3020150b8388cef8ce9
- SHA1 6725272b062e3692a9f2dbe71b4b1b2d1871d53b
- SHA512 c7077fac7da5fff4a88301f33eba04d60cd1bc1865c756340b51b74e2c756b86a26c83bc98c290f77bb24b11b3a21f201054ba247753d792cee3bce1def564d4
- SSDEEP 49152:r9mqCzDScAZmlvTcFg8Ph6GAQgAT76sQuE:vIqGsQr
- TLSH T17A955C05F7EB5298E8B3CAF1C96694159B327C509B34F7EF0A80CA6A1E32BD1D534B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 8b1b0ef2b39ca7d4330bc36891d4957d1d459bd5be74d5cfc4c7db2b432259fc
- MD5 31825c4cfee1e472709b71a8f78afdf5
- SHA1 4b9436766ae53c0fd2afca3e2752d6548c08d0ee
- SHA512 1540e40354304e5c0d78d67ac387c9a3e57829cc7828d5be8bf129dd0da44ca5aaee6ef804077c948861cd101d25e4d529599f4e81f0d81e9fe66030274eddfc
- SSDEEP 24576:9lYJeXm5jUuEwAfYLH8AcevDN0FImbwQuq3Wia7gD:9lYJeXmRUuEwAQgAT76sQuE
- TLSH T19555125E269C30E9E57ED03988B24568E3B1B4B5530163FF01D0C2BA5F3B9E56E78E50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 2b1e32bb4e6c09b9d20ec8bf1e676bb80dce8c2f2dd3c23f5cbfc331d06fd571
- MD5 f8caf28888fcc208a0c27ac2031458c7
- SHA1 c4c820b187ac488fc6e602a175d02ac1ba78c5e6
- SHA512 e34e05770ed8be7aaa71743d99aa44a35c2e6e0145132f725ed7fb9abb6e515046780ba5ac9a600ab2b6a10bfcd864dc91aeae781c3e01bd4dd85e240a18d2c7
- SSDEEP 24576:i7ty/AfYLH8AcevDN0FImbwQuq3Wia7gD:i7tuAQgAT76sQuE
- TLSH T1C8651206639860E9F9BA8538CDB381B49B75BC748B0193DF1091B73F6E3A6D4A570F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 a4a76164509db27d1756488f30b3b1fa245cf02721e35d9520674f3fb024e831
- MD5 fcb7333018b6448c043ccf132c1fd40b
- SHA1 2e74905a4cbd407c2fd17e73839b7804a359e04f
- SHA512 63480255d41c0d4707e8dde7d9310cb0fc0484cd23a126b4c99d1e89eee40926f7584cf39500a2016c7c5fae72c350b2734ae84ffed9f9ccfb8cea2fb40e38a4
- SSDEEP 12288:jPAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:7AAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T12B55235F064C30EEFCBAD135887755B863E17CB8930162EF1085AAB9AE3E485D1F4D64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 ad9e71dad86d0688f36c15095ab9ab6c937ecc00bba9b80ab383ba96b5676305
- MD5 c94a4f02d8537b6d82c1a7b128769163
- SHA1 3c37c49b6a1121818a83cc9c4534c9f60ebc3164
- SHA512 50ceecb25be279d427b0c86baea2028a036524f966bb32b8e266fa86d1d2cd8ba95380668a16d70f4cb9c67bcff5b8be4195134835be7f9d9cbfc672396cf0eb
- SSDEEP 24576:9C+TyQIu93VAumZr7jm1AfYLH8AcevDN0FImbwQuq3Wia7gD:9/TfIq+Y1AQgAT76sQuE
- TLSH T152558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 23515a8b2718ce4db84bd21c3261ba2497ed7a709d1fc9681fccb4446c045c4b
- MD5 847f6147caa5762e60af42f20a3436ce
- SHA1 bca4d8c8b97b5ca9ef5ff81657ac191da8ffb94d
- SHA512 7bbde70d77b890219cd25bb07e2b49c99360468ce3ae18c8cc4078f7ff8cca9aaa52770c49d58fa812eaa48543b5be75907a200a32e49f79557215443d57a100
- SSDEEP 24576:yLQikZkAfYLH8AcevDN0FImbwQuq3Wia7gD:4QikCAQgAT76sQuE
- TLSH T19B65F00FB2AE10A6E4ABC13C88964166F6B37474430263DF0290C77A5B7B5E9BD78F51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 e6613c3fe78c3f1282a4421875d6948d3e2f8cde8dd3adddfbc42fa5bc7d995f
- MD5 0cdaf7be11e2e8d34c911ce2003621ca
- SHA1 b51c1eee0475f47d4b82cfe22328115ce237bf31
- SHA512 f82df141e8cfacc49a4889917bc3d38645b6652eb3840bdf021a31835ebd8ac579f2b589d3e973a2564324663b3d9b19cbba38355389fe04b04321f43c843a98
- SSDEEP 49152:ypJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP/AQgAT76s+:vpC7b4+80GTknqGsQr
- TLSH T195A57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 448c6744aa38784358a286286bd3f537c409cdaf5dab4894d10e832a8aef9659
- MD5 9bd9269b7445cbf2d78a2c8a6883abda
- SHA1 b6116915d99a84582a9864037eda5c17a6152317
- SHA512 98c73ee0c6bba525bb84b3559a72baca96bd4f0ea2dd3147519a8ab827b2ab8f89b99419ec8794ed6d1efb0a631a521d16c50a2fafdaed9979edaa319c9b0d3e
- SSDEEP 24576:+SAwJPE1IDAo+4Kt+l4413JUQ3AfYLH8AcevDN0FImbwQuq3Wia7gD:+qPCIo4Kol4vQ3AQgAT76sQuE
- TLSH T18355B02AA7F956F5E17AC774C663C611FB727822133163CF4290817E0E269E89E79F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 f63877f7d8f3dfdab5a00e25ad4a3f741a2c9a51e67e023d62129209a4862ffc
- MD5 6cbc986f241d388d2f432923d5668241
- SHA1 fc3be8c88153928f810265af66a72c58e3839a82
- SHA512 1bcd2fc29bdaec1b1875595197b6a4813977cfb490580b82b7504f1dd924e6dda62a4661a04fe1e478739d23fd14e783b380e681e85c011a6d3a0cc214ad75b2
- SSDEEP 24576:ByLXPLcw94tnAfYLH8AcevDN0FImbwQuq3Wia7gD:By7PoXtnAQgAT76sQuE
- TLSH T1C075E03ED76C04E5E47AC27CC6A38506F6723CAD032166CB15A491792F7BEE4A939F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 b9e64b49697f38dfb463bb94f96cf35935626506285b5e2204da97a14b6dce7e
- MD5 f4d2e6c87de209e856d253f1a024721d
- SHA1 d94ba60c254b67d9ae46e61d57f3768457c8f58f
- SHA512 53e3ae861adcd328d650d04e4071b5f5bf993b7f79428e55f2ba9557162b8a6437db387089989dd5cc2e4688deaacebec682fce45f912360efcecde881fa8181
- SSDEEP 24576:iWv8qjp0AfYLH8AcevDN0FImbwQuq3Wia7gD:iWv8PAQgAT76sQuE
- TLSH T14C65125F569834D9F47A8234D933817992B1BCB6135496FF30C89ABA4B39AC0D17EF20
- MD5 SHA1 SHA512 SSDEEP TLSH